Inside AdaCore...Inside AdaCore January–June 2019 V19 Product Release VDC Report: Ada Helps Reduce Costs AdaCore Awarded Air Force Research Contract for System-to-Software Integrity

Inside AdaCore

January–June 2019

V19 Product Release

VDC Report: Ada Helps Reduce Costs

AdaCore Awarded Air Force Research Contract for System-to-Software Integrity Support

Tech Days 2018

AdaCore at HIS 2018 Conference

Interview with Joël Brobecker

Ada on General Purpose GPUs

AdaCore at Future Airborne Capability Environment (FACE™) Technical Interchange Meeting

New AdaCore Office

Excerpts from the AdaCore Blogosphere

V19 Product Release AdaCore’s annual major product release is taking place during Q1 2019, with enhancements in functionality, performance, and user convenience. A number of specific improvements are listed below; for more comprehensive and detailed information please visit the relevant “New Features” page online:

GNAT Pro base technology: docs.adacore.com/R/relnotes/features-19

GPS and GNATbench IDEs: docs.adacore.com/R/relnotes/features-ide-19

GPR library and tools: docs.adacore.com/R/relnotes/features-gprbuild-19

CodePeer: docs.adacore.com/R/relnotes/features-codepeer-19

SPARK Pro: docs.adacore.com/R/relnotes/features-spark-19

QGen: docs.adacore.com/R/relnotes/features-qgen-19

GNAT Pro 19.1 Development EnvironmentsGNAT Pro Ada is now available on 62 platforms (57 cross, 5 native). Product highlights and benefits include:

y Support for RISC-V (64-bit) ELF, ARM AArch 64 (ELF, Linux, QNX, and VxWorks 7), PowerPC Linux, and Intel x86 LynxOS-178 2.2.4

y Toolchain upgrade to GCC 7, Binutils 2.30.52, GDB 8.2, MinGW 5.0, and QEMU 2.12

y Inclusion of the libadalang library for lightweight static analysis, for customer applications that need to parse Ada source code

y Mitigation of the Spectre V2 security vulnerability, through the -mindirect-branch and -mfunction-return switches

y Generation of Ada 2012 syntax from C and C++ header files, through the -fdump-ada-spec switch

y Simpler mixing of Ada and C++, and support for Wind River’s LLVM technology, on VxWorks targets

Also available are v19 releases of the GNAT Pro Common Code Generator (CCG), which compiles a SPARK-like subset of Ada into C source code, and the GNAT Pro C and GNAT Pro C++ development environments.

A variety of enhancements have been made to the GNAT Pro IDEs and tools; here is a sampling:

y GPS (GNAT Programming Studio) IDE: Improved speed, new views, better integration with the debugger, and a revamped / simplified mechanism for specifying color preferences and theme support

y GNATbench Eclipse plug-in for Ada: Better integration into Work-bench, support for Eclipse 4.8 Photon and Wind River Workbench 4.8, and improved Ada/C++ exception handling on VxWorks 7.

y GNATdashboard information visualizer: Support for SonarQube 6.7 LTS and a new Web interface

y GPRbuild multilanguage program builder: Automatic recompilation when a new version of GNAT Pro is used, and removal of the compiler command line length limitation on Windows

y GNATcheck qualifiable Ada coding standard checker: Addition of many new rules

y GNATcoverage qualifiable code coverage analyzer and reporter for Ada and C (available as an add-on tool): Improved handling of state-ment coverage for Ada code with pragmas, and support for programs with a compressed debug information section

CodePeer 19.1 Advanced Static Analyzer for AdaEnhancements in the latest CodePeer release are focused on usability / user interface improvements. These include:

y New entry level (“level 0”) with fast analysis and minimal false positives, enabled by default

y Simple “getting started quickly” mode for new users without requiring complex project set up

y Security report output

y Major documentation update, including examples of typical workflows

y GNATcheck integration

y Ability to show only new messages, and to compare any two runs

SPARK 19.1 Formal Verification ToolsuiteA variety of improvements have been incorporated into SPARK Pro and SPARK Discovery, including:

y Increased support for fixed-point types and operations

y Better messages, to help in investigating unproved checks and detecting inconsistencies

y More predictable tool execution time, via --level switch

y Speedup on large projects

y New analysis report panel in GPS

y Automatic detection of array initialization with non-static bounds

y Improved GPS integration, allowing focused analysis on specific region of code

Several enhancements are specific to SPARK Pro:

y New lemmas for exponentiation, fixed-point arithmetic and higher-order functions

y Better counterexamples on individual paths through subprograms

y Improved support for floating-point computations

QGen 19.1 Qualifiable Model-Based Engineering ToolsuiteQGen, AdaCore’s qualifiable and tunable code generation and model verifi-cation tool suite for a safe subset of Simulink® and Stateflow® models, has seen enhancements in several areas:

y Model exporter

ÌÌ Support for incremental export (only re-exporting the models that changed)

ÌÌ Better performance

y Modular code generation

ÌÌ Ability to regenerate code only for updated models

ÌÌ Faster code generation

y Enhanced support for Simulink® models

ÌÌ Support for Extract Bits block

ÌÌ Support for Simulink® versions up to R2018b

ÌÌ Support for additional block configurations

y Debugger

ÌÌ Improved diagrams

ÌÌ Better traceability from model to code (e.g., internal states, datastores)

TM

COMPATIBLE

TM

COMPATIBLE

AdaCore Awarded Air Force Research Contract for System-to-Software Integrity SupportAdaCore has received a contract from the U.S. Air Force Research Laboratory (AFRL) under the Collaborative Research and Development for Innovative Aerospace Leadership (CRDInAL) Thrust 3. The project is focused on formally backed Model-Based Systems Engineering.

In this effort, AdaCore is expanding upon its tool support for System-to-Software Integrity (SSI) by delivering prototype translators from the SysML modeling language to AADL augmented by the AGREE (Assume Guarantee REasoning Environment) annex; from AADL+AGREE to Simulink; and from Simulink to SPARK. AdaCore is demonstrating the utility of these prototype tools by applying them to OpenUxAS, a US Air Force-relevant service-oriented architecture designed to support autonomous control of multiple unmanned assets. AdaCore is also rebuilding several OpenUxAS services in SPARK and applying the SPARK Pro technology to prove critical, safety-related functional properties of these services.

The project will be completed in January 2020.

Tech Days 2018AdaCore held its annual customer-focused Tech Days conferences on October 4 in Paris and on November 14–15 in Boston, attracting record attendance (around 50 at each). Attendees learned up-to-date information on the company’s latest offerings and future plans, viewed live demos of several products, and met with AdaCore technical experts and sales team representatives one-on-one to have any and all questions answered.

Presentation topics common to both the Paris and Boston events included AdaCore’s market perspective, the growing Ada/SPARK community, GNAT Pro and CodePeer updates, Ada and General Purpose GPUs, SPARK Pro and other technologies for cyber security, QGen and TQL qualification, GNAT Pro support for C and C++, a new mentoring service for AdaCore technology adoption, and an update on the libadalang lightweight static analysis tool.

The Paris Tech Day also included a presentation on Python integration in GPS as well as customer presentations from David Sibai (BNP Paribas) and Nils Ignell (Scandinavian Real Heart).

The Boston Tech Days included talks on how AdaCore’s static analy-sis tools detect and report CWE weaknesses, how an organization can integrate GPS into their workflow, why it’s helpful to be using the latest version of Ada, how AdaCore supports the FACE™ (Future Airborne Capability Environment) initiative, hints on exploiting the GDB debug-ger, and how GNAT Pro simplifies the handling of endianness issues. The Boston Tech Days conference also featured a keynote address by Robert Martin from the MITRE Corporation on “Assured Software: A Journey and Discussion”.

Slides from the Tech Days presentations are available at www.adacore.com/tech-days-eu/ and www.adacore.com/tech-days-us/.

AdaCore at HIS 2018 ConferenceThe fifth annual High Integrity Software Conference took place this year in Bristol, UK, in November 2018 and saw a record attendance of 160 industrial and academic specialists across a range of industry sectors. The conference continues to benefit from the longstanding support of key industry players AdaCore, Altran, and Jaguar Land Rover; their contribution ensures that the program captures the most pressing and relevant issues and topics of debate.

AdaCore’s Yannick Moy delivered a presentation on “Programming Languages for C-cured Software”. He explained how the defense against “defect attractors”—core features that defeat attempts at higher software quality—comes from a combination of language constructs and supporting tools, and how selecting a better programming language can significantly improve software quality. For a copy of Yannick’s slides, please visit www.his-2018.co.uk/slides/.

Besides this presentation on the merits of programming languages for security, the track on “Languages and Applications” showed how SPARK is used as a key technology to ensure the safety of an artificial heart (in a presentation by Scandinavian Real Heart) and the security of a USB key (in a presentation by ANSSI, the French Network and Information Security Agency). The parallel track on “Cyber Security - People and Practice” spanned various domains of cyber security, from developer education to security testing and best practices. Another strong theme of the conference was the assurance of autonomous systems, which was the focus of the two plenary talks and the concluding panel session.

To receive updates about the 2019 event, follow @HIS_Conf on Twitter.

VDC Report: Ada Helps Reduce Costs A 2018 report from VDC Research, “Controlling Costs with Software Language Choice”, examined the role of programming language technology in the Total Cost of Ownership (TCO) for IoT and Embedded Engineering projects and concluded that “Ada was one language that stood out in its impact on various project success metrics”. Based on a survey of more than 700 respondents, VDC’s TCO calculator showed significant development cost savings from Ada relative to other languages (C, Java, C++ and C#) across a range of applications on several platforms. The surveyed systems included communications/networking, aerospace and defense, and automotive, deployed on x86- and ARM-based configurations.

The report cited several factors in explaining Ada’s cost savings:

Reliability. Ada has a proven track record in critical real-time embedded systems, and its many checks can catch errors before they become vulnerabilities or bugs.

Reusability. Ada helps developers to leverage existing software for subsequent reuse, both through specific language features and through its status as an ISO standard with well-defined semantics.

Flexibility and scalability. Features such as hierarchical libraries allow an organization to extend an existing system and adapt it to new requirements, without modifying the original code base.

Ease of use. Ada has built-in support that makes it easy to interface with other languages, and a variety of resources are available to help developers transition to Ada from other language technologies.

The bottom line from VDC’s survey and analysis: “Ada’s evolution has made it an increasingly compelling option for engineering organiza-tions, providing both a technically and financially sound solution”.

Please go to www.adacore.com/vdc-report.pdf to download the full report.

interview

Joël BrobeckerSenior Software Engineer

Joël, tell us about your background and how you came to be involved with Ada and AdaCore. What is your current role?I discovered Ada during my engineering studies at Télécom Bretagne in France, where I was fascinated by the number and diversity of programming lan-guages that were out there. I learned a lot from experiment-ing with the various languages, but eventually I realized that

they all had significant drawbacks if I wanted to write and maintain a large and reliable application. The most important tool for software development seemed to be the debugger.

Since I did not have a personal computer—in those days it was too expensive for a student—I was spending a lot of time in my school’s computer lab. This was a very open and collaborative environment, where I could share my thoughts and opinions and get feedback from fellow enthusiasts. Hearing my frustrations with the other languages, one of the them told me about Ada (this was the Ada 95 version of the standard). I quickly became hooked, appreciating how the language helped me write clean, modular and robust code. I still remember how my colleagues and I were able, in just a few months, to implement a distributed ray tracing program. With other languages, programming a concurrent application meant coping with low-level and error-prone mechanisms like semaphores and condition variables; Ada’s tasking support was higher level, hiding the complexity and preventing some subtle bugs.

I always appreciated the benefits of open and collaborative software development, and after finishing my studies I wanted to contribute back to the Free Software community. So I started the GtkAda project, which is a graphics library for Ada and more than just a wrapper for the C API. I worked on this with Emmanuel Briot and Arnaud Charlet from AdaCore, a company which I knew had strong ties to Free Software and Ada. I was really excited to join the team a couple of years later.

Your responsibilities at AdaCore span a broad range: version control system expert (svn, git), GDB guru, release

coordinator, QA coordinator, and much more. It’s fair to say that you are someone who helps keep the company’s product infrastructure machinery well oiled. What do you see as the main challenges, and how do you meet them?The main challenge is related to the volume and diversity of activities needed to develop and maintain high quality products on an annual major release cycle. AdaCore supports a very wide range of platforms, both native and cross. Each cross configuration brings its own unique set of issues because of differences from one to another (RTOS versus bare metal, Board Support Package idiosyncrasies, etc.) so setting up and administering a test environment requires some specialized skills. We also constantly need to evolve—to follow the industry, support new CPUs or RTOS versions, and so on—based on customer needs. And in addition to our regular annual release cycle, we also have to be able to deliver intermediate versions for any of our tools on very short notice. This requires a very strong and constant emphasis on Quality Assurance, with a high degree of automation.

There’s no “secret sauce” that AdaCore uses to get this done, it’s a combi-nation of factors. On the technology side, continuous integration tools are run automatically upon check-in and provide rapid feedback, nightly test runs with test suites comprising millions of lines of code help detect regressions, and problems are tracked with an audit trail that allows us to pinpoint exactly when and how they get resolved. I have seen our QA processes evolve and mature over the eighteen years that I have been with the company, and another key element is the open communication and collaboration that is intrinsic to the AdaCore culture. That’s how I have been able to participate, observe, get feedback, and eventually refine my understanding of the big picture so that I can contribute most effectively.

Any hobbies or outside interests that you’d like to share?In my spare time, I am a tennis official with an international certification level as a Referee. This allows me to act as the Supervisor at the lower tiers of professional tennis events. The role of the Supervisor is very different from the role of the Chair Umpire or the Line Umpires; although we occasionally get called to court to discuss the correct application of the rules, it is mostly an organizational role performed off court. The approach that guides me is to help bring everyone together towards trying to get the best tournament possible for the players, spectators and tournament organizers, all of this in a pressure-filled environment. Interestingly, I discovered that organization, leadership, communication, and the ability to handle difficult situations are key assets, and have found that what I learned during tennis tournaments could be applied to my day-to-day work at AdaCore!

Joël Brobecker photograph by Gary Matoso

Ada on General Purpose GPUsOn September 18, 2018, AdaCore’s Quentin Ochem presented a webinar showing how Ada and SPARK could be adapted to improve the reliability of software targeted to General Purpose Graphical Programming Unit (GPGPU) platforms while exploiting the massive parallelism offered by GPGPU technology.

The approaches currently used for GPGPU programming—shading languages, GPU-specific languages, or C code with pragma intertwined—are low-level and/or subject to well-known C vulnerabilities such as buffer overrun. As the use of GPGPUs grows and applications become more complex, developers need language technologies that scale up to meet new demands, make efficient use of the underlying parallelism, and help in avoiding con-currency bugs such as race conditions, deadlock, and corrupted data. The webinar demonstrated how Ada, SPARK, and AdaCore tools could contribute towards this goal.

The webinar presented a brief overview of typical GPU architecture and explained GPU programming, how to use existing GPU libraries, and how to use Ada in conjunction with current GPU approaches (CUDA, OpenCL, interlacing CPU and GPU code with OpenACC).  It also covered the parallel loop facility proposed for the next Ada language standard, and how to use SPARK to formally prove the absence of unwanted data dependencies and the absence of run-time errors. The webinar concluded with a roadmap of forthcoming AdaCore GPGPU-related activities and a call for participation to those who would like to influence the technical direction.

The webinar is available online at www.adacore.com/webinars/ada-and-gpu/.

AdaCore at Future Airborne Capability Environment (FACE™) Technical Interchange MeetingAdaCore had a major presence at the September 2018 U.S. Army FACE™ Technical Interchange Meeting in Huntsville, Alabama, with a paper in the on-line proceedings, a presentation during the plenary session, and a demo at the company’s booth in the exhibits hall.

The paper, “Ada Language Run-Times and the FACE™ Technical Standard: Achieving Application Portability and Reliability”, was authored by Benjamin Brosgol, Patrick Rogers and Dudrey Smith. It describes how AdaCore’s Cert and Ravenscar-Cert libraries meet the portability requirements for the FACE Safety profiles while also satisfying the assurance requirements of systems that need to meet the highest levels in software standards such as DO-178B and DO-178C. The Cert and Ravenscar-Cert libraries have been implemented for Wind River’s FACE conformant VxWorks 653 RTOS and also for Lynx Software Technologies’ LynxOS-178 RTOS. The paper is available at tinyurl.com/adacore-face-tim-2018/.

The presentation, delivered by Patrick Rogers, summarized the paper and explained the Ada features supported in the two run-time libraries.

The demonstration in the AdaCore booth, conducted by Robert Tice, showed how the GNATcheck static analysis tool can help detect uses of features outside the Ada subsets allowed by the FACE Safety profiles.

For more information about AdaCore and the FACE approach to component portability and assurance, please contact [email protected].

New AdaCore OfficeAdaCore is growing! The company has opened a new office in Estonia to serve an expanding market for tools and technologies that apply throughout the software life cycle.

Effective September 1, 2018, AdaCore acquired the modeling and code generation branch of IB Krates OÜ, an Estonian technology company that has been partnering with AdaCore on the development of the QGen qualifiable model-based engineering toolsuite for almost ten years. The newly-created AdaCore Estonia OÜ inherits a strong pedigree in system analysis, requirements management and implementation of industrial systems from IB Krates OÜ. Their expertise will complement AdaCore’s traditional strengths as a supplier of development and verification tech-nologies. The new AdaCore office is located in Tallinn, Estonia, and is led by Tõnu Näks, previously the R&D Manager at IB Krates OÜ.

Excerpts from the AdaCore BlogosphereAda on FPGAs with PicoRV32 • September 11, 2018 AdaCore’s Fabien Chouteau shows how to configure the GNAT RISC-V Ada compilation environment to support the PicoRV32 CPU on a TinyFPGA-BX board, as an adaptation of the target environment for the HiFive1 RISC-V microcontroller. The steps involve specifying and building a new run-time, which differs from the HiFive1 in its mem-ory map (RAM and flash), text I/O driver (UART), and instruction set extensions. The memory map is defined using a simple linker script, and the text I/O driver is captured by the declaration of the two PicoRV32 registers and the associated operations for initialization and character output. A Python script defines the new run-time through a class that specifies properties such as compiler switches and files to be included. The run-time can then be built (on a Linux 64-bit host) by a Python script in the bb-runtimes repository and then compiled and installed. A sample project, which includes a custom Verilog module, illustrates and exercises the new configuration: a peripheral that con-trols WS2812 RGB LEDs (also known as Neopixels).

Train control using Ada on a Raspberry Pi • September 18, 2018As part of her master’s thesis in Embedded Systems Engineering at FH Campus Wien (Austria), Julia Teissi designed and implemented a control system in Ada for an on-demand autonomous model train system. The hardware platform consists of a Raspberry Pi 3 for message handling (the MRP), an Electronic Solutions Ulm Command Station 50210 for communication and an STM32F1 microcontroller to trigger the display. The train control software makes heavy use of Ada’s tasking features. “Each train has its own task storing and processing information: it has to identify its position on the track or the next station to stop at and to offer information like which message it expects next. One main task receives all the messages from the MRP, analyzes them and passes them to the different train tasks. The main part of the software is to handle and analyze all the  messages, since each component like the signals or turnouts have their own protocols to adhere to. Thankfully, rendezvous in Ada are very easy to implement so it was fun to write this part of code.”

Complete versions of these and other posts are available at blog.adacore.com/.

calendar highlights / January – June 2019

For up-to-date information on conferences where AdaCore is participating, please visit www.adacore.com/events/.

FOSDEM (Free and Open source Software Developers’ European Meeting) February 2–3, 2019 / Brussels, BelgiumAdaCore is presenting at this event. fosdem.org/2019/

Safety-Critical Systems Symposium (SSS) February 5–7, 2019 / Bristol, UKAdaCore is exhibiting at this event. scsc.uk/e569

Embedded World 2019 February 26–28, 2019 / Nuremberg, GermanyAdaCore is presenting and exhibiting at this event (Booth 149-4). www.embedded-world.de/en

ACM SIGCSE 2019  (Computer Science Education) February 27–March 2, 2019 / Minneapolis MN, USAAdaCore is exhibiting at this event (Booth 514). sigcse2019.sigcse.org/

Aerospace Tech Week – Avionics Expo March 12–13, 2019 / Munich, GermanyAdaCore is exhibiting at this event (Booth A14) and giving a talk on “Qualification strategy for an automatic code generator”. www.aerospacetechweek.com/event/avionics-expo/

Public Ada Training June 3–7, 2019 / Paris, FranceAdaCore is conducting an introductory Ada course at its Paris office. www.adacore.com/public-ada-training

Ada-Europe 2019 June 10–14, 2019 / Warsaw, PolandAdaCore is exhibiting at this conference. www.ada-europe.org/

© Copyright 2019 AdaCore. All rights reserved. All trademarks are the property of their respective owners.

Inside AdaCore is published twice a year simultaneously in New York and Paris by AdaCore.

46 rue d’Amsterdam75009 Paris, Francetel +33 1 49 70 67 16fax +33 1 49 70 05 52

150 W. 30th Street, 16th floorNew York, NY 10001, USAtel +1 212 620 7300fax +1 212 807 0162

[email protected]

newsflash

ci-tec chooses GNAT Pro Ada for process control softwareThe German industrial process control company ci-tec has chosen AdaCore’s GNAT Pro Ada to port, adapt and maintain its inspect pro control product. Inspect pro control is a real-time system that records and analyzes diverse sensor data, for example from infrared cameras, and integrates the results for process control. The product is used in a range of industrial contexts including waste incineration (for both hazardous and non- hazardous waste), cement production and zinc recycling. GNAT Pro’s modern build tools and Integrated Development Environment, as well as AdaCore’s expert support services and long-term commitment to the Ada language, factored heavily in ci-tec’s decision on language technology.

SPARK Pro is CWE-CompatibleSPARK Pro has been designated as CWE-Compatible by the MITRE Corporation’s Common Weakness Enumeration (CWE) Compatibility and Effectiveness Program, a web-

based initiative that consolidates and organizes information about cyber security products and services. SPARK Pro meets the MITRE program’s criteria for CWE searchability, output, and coverage, and it detects a variety of code weaknesses that are among the CWE’s Top 25 Most Dangerous Software Errors (such as buffer overflow and integer overflow/wraparound). Please visit cwe.mitre.org/compatible/program.html and cwe.mitre.org/compatible/compatible.html for further information.

AdaCore blog book is availableAdaCore has published a collection of blogs—Embedded SPARK & Ada Use Cases—that show how to use Ada and SPARK for low-level applications that typically would seem to call for C. The posts go into detail on subjects such as implementing a Tetris game in SPARK for an ARM Cortex M4, getting started with the Ada Driver’s Library device drivers, writing a candy dispenser controller in Ada, and using the GNAT Common Code Generator (CCG) to get Ada/SPARK code running on the Arduino-controllable Polulu Zumo v1.2. robot. For a printed copy of the book, please contact [email protected]; an online version is available at www.adacore.com/books/embedded-spark-and-ada-use-cases/.

AVIO chooses GNAT Pro Ada for ESA-sponsored projectThe European aerospace company AVIO has selected the GNAT Pro Assurance Ada Development Environment, including the GNATemulator host-based target emulation tool, to implement the on-board software for AVIO’s Vega-C launcher. Scheduled for completion in 2019, the Vega-C on-board software project includes certification of the ZFP run-time library at level B of the European Space standards ECSS-E-ST-40C and ECSS-Q-ST-80C. AdaCore’s strong heritage with Ada, and the availability of run-time library certification material, were prime reasons that the company was chosen as the Ada vendor.

TM

COMPATIBLE

contact us!Please contact us at [email protected] with questions/comments or to get further information about any of the items in this newsletter.